We've found that using postfix-policyd (http://policyd.sourceforge.net/) on our postfix servers stops a lot of spam and viruses from even being accepted. It has all sorts of features that are well worth having on any mail server (whitelists, blacklists, grey listing, spam traps, etc).
I've got it installed (using the zimbra mysql server) but I can't add the restriction to smtpd_recipient_restrictions in postfix. Normally I'd just add it to main.cf, but it seems that line is rewritten when zimbra starts up. I've added it to the zimbraMtaRestriction configuration parameter, but it doesn't seem to be making it into main.cf when zcontrol starts postfix.
zimbra:~$ zmprov gcf zimbraMtaRestriction
zimbraMtaRestriction: check_policy_service inet:127.0.0.1:10031
zimbra:~$ grep smtpd_recipient_restrictions /opt/zimbra/postfix/conf/main.cf
smtpd_recipient_restrictions = reject_non_fqdn_recipient, permit_sasl_authenticated, permit_mynetworks, reject_invalid_hostname, reject_non_fqdn_sender, reject_unauth_destination, permit
I take it that zimbraMtaRestrictions aren't copied verbatim into main.cf?